Bump to v0.2.1 — Batch 3 playtest fixes + auto-updater fix

- Fix: repost + quote buttons added to RootNote in ThreadView (Issue A)
- Fix: switchAccount no longer silently goes read-only when nsec keychain
  entry is missing — nsec accounts stay logged out so the login button
  handles recovery; loginType field added to SavedAccount (Issue B)
- Fix: macos-12 runner replaced with macos-13 in release.yml — macos-12
  was deprecated by GitHub, causing macOS jobs to never run, which
  prevented latest.json from being assembled and broke the auto-updater
  for every user since v0.1.5
- Bump Cargo.toml version (was stuck at 0.1.10)
- Release notes updated with v0.2.1 + v0.2.0 Phase 2 changelog
- README: Windows unsigned installer note added
- ROADMAP: NIP-05 monetization added to brainstorm backlog

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/stores/user.ts

@@ -13,6 +13,7 @@ export interface SavedAccount {
   npub: string;
   name?: string;
   picture?: string;
+  loginType?: "nsec" | "pubkey";
 }
 
 // In-memory signer cache — survives account switches within a session.
@@ -98,7 +99,7 @@ export const useUserStore = create<UserState>((set, get) => ({
       _signerCache.set(pubkey, signer);
 
       // Update accounts list
-      const accounts = upsertAccount(get().accounts, { pubkey, npub });
+      const accounts = upsertAccount(get().accounts, { pubkey, npub, loginType: "nsec" });
       persistAccounts(accounts);
 
       set({ pubkey, npub, loggedIn: true, loginError: null, accounts });
@@ -142,7 +143,7 @@ export const useUserStore = create<UserState>((set, get) => ({
       const npub = nip19.npubEncode(pubkey);
 
       // Update accounts list
-      const accounts = upsertAccount(get().accounts, { pubkey, npub });
+      const accounts = upsertAccount(get().accounts, { pubkey, npub, loginType: "pubkey" });
       persistAccounts(accounts);
 
       set({ pubkey, npub, loggedIn: true, loginError: null, accounts });
@@ -229,7 +230,13 @@ export const useUserStore = create<UserState>((set, get) => ({
       // Keychain unavailable
     }
     if (!succeeded) {
-      await get().loginWithPubkey(pubkey);
+      const account = get().accounts.find((a) => a.pubkey === pubkey);
+      if (account?.loginType === "pubkey") {
+        // Deliberately read-only (npub) account — correct behavior
+        await get().loginWithPubkey(pubkey);
+      }
+      // else: nsec account whose keychain entry was lost.
+      // Stay logged out; user sees AccountSwitcher "login" button to re-enter nsec.
     }
     // Always land on feed to avoid stale UI from previous account's view
     useUIStore.getState().setView("feed");